Connect policy-gated browser review and audit runtime

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/fixtures/review-policy/policy.md

@@ -0,0 +1,50 @@
+---
+id: informed-decision.fixture
+name: Synthetic review API contract fixture
+namespace: informed-decision:decision-memo
+version: v1
+status: ready
+package: flexauth.informed_decision.fixture
+allow_ttl: 60s
+actions: [read, acknowledge, accept, return, discuss, decline]
+owner: fixture-only
+fixtures: [fixtures.json]
+caring:
+  profile: caring-0.4.0-rc2
+  enforce: false
+activation:
+  mode: local
+---
+
+# Synthetic component fixture, never a production policy
+
+Only the locally signed human-fixture and memo:memo-1 can exercise this test.
+No production approver, group, mandate or permission is established here.
+No presentation claim, view hash, acknowledgment or local outcome is input.
+
+```rego
+import rego.v1
+
+decision := {"effect": "allow", "reason": "synthetic_review_fixture"} if {
+  input.tenant == "tenant:platform"
+  input.subject.id == "human-fixture"
+  input.subject.type == "human"
+  input.resource.system == "informed-decision"
+  input.resource.type == "decision-memo"
+  input.resource.id == "memo:memo-1"
+  input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
+  input.context.approval_id == "fixture"
+} else := {"effect": "deny", "reason": "fixture_scope_refused"} if {
+  true
+}
+```
+
+```rego test
+package flexauth.informed_decision.fixture_test
+import rego.v1
+import data.flexauth.informed_decision.fixture
+
+test_unknown_request_denied if {
+  fixture.decision.effect == "deny" with input as {}
+}
+```